CVE-2026-84479

Name of the Vulnerable Software and Affected Versions WWBN AVideo versions e01e41ecc and earlier

Description Three security controls during the login process rely exclusively on the client-supplied User-Agent header. The functions isAVideoEncoder() and isAVideoMobileApp() compare the HTTP USER AGENT against hardcoded literals ("AVideoEncoder" or "AVideoMobileApp") without verifying the IP address or using a shared secret. An attacker with valid credentials can set the User-Agent to "AVideoEncoder" to bypass two-factor authentication, skip brute-force captcha escalation, and avoid being recorded in the login and device audit history.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.